From d0312cece9ce89d783687ff6dddaae6495e19fcf Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Mon, 15 Mar 2021 21:37:58 -0700 Subject: [3.9] bpo-43285: Add a What's New entry for 3.9.3. (GH-24888) Covers the ftplib security fix. --- Doc/whatsnew/3.9.rst | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Doc/whatsnew/3.9.rst b/Doc/whatsnew/3.9.rst index 3086930..4cb4940 100644 --- a/Doc/whatsnew/3.9.rst +++ b/Doc/whatsnew/3.9.rst @@ -1529,3 +1529,12 @@ separator key, with ``&`` as the default. This change also affects functions internally. For more details, please see their respective documentation. (Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in :issue:`42967`.) + +Notable changes in Python 3.9.3 +=============================== + +A security fix alters the :class:`ftplib.FTP` behavior to not trust the +IPv4 address sent from the remote server when setting up a passive data +channel. We reuse the ftp server IP address instead. For unusual code +requiring the old behavior, set a ``trust_server_pasv_ipv4_address`` +attribute on your FTP instance to ``True``. (See :issue:`43285`) -- cgit v0.12